1.  Are the private/secret keys copied regularly to the global vault?  Yes

2.  If a user was to have his/her laptop destroyed (run-over, stolen, submerged, etc) will the ID in the vault be sufficient to allow the user to see all encrypted emails on a new laptop?  Yes

3.  Does re-certification work the same way as before - can an admin re-certify everyone without user interaction?  Yes

See the Notes/Domino wiki for more details and helpful hints:

https://www-10.lotus.com/ldd/dominowiki.nsf/xpViewTags.xsp?categoryFilter=Notes%20Shared%20Login
https://www-10.lotus.com/ldd/dominowiki.nsf/xpViewTags.xsp?categoryFilter=Notes%20ID%20Vault

Even when a user is vaulted. it is possible that their current public key is not the same as the one stored in the Domino Directory.  Since mail sent to Jane Doe/ACME is encrypted using the public key stored in the Domino Directory, Jane Doe will only be able to read an encrypted email if the public key contained in her Notes ID is the same as the public key stored for her in her Person Record.  If you grep your server's console.log and find "Your public key does not match the one that is stored in the Address Book," then you won't be able to read encrypted mail.